Hello
I have a problem with TROJ_ACEBOT.A using System Suite 2000 by On
Track the virus scan tel’s me it has removed the fill but if I re-scan
it is still there.
I have a Fujitsu Siemens Xpert with an AMD 600 and Windows ME.
Regards
tt.
thomast@thomast.worldonline.co.uk

Since this virus installs itself in the Windows system folder, it is
probable that this file is being backed up by Windows ME's system
restore feature, which may be why it is coming back repeatedly--virus
scanners cannot eliminate the System Restore files.

To disable System Restore:
1. Right click the My Computer icon on the Desktop and click on
Properties.
2. Click on the Performance tab.
3. Click on the File System button.
4. Click on the Troubleshooting tab.
5. Put a check mark next to 'Disable System Restore'.
6. Click the 'OK' button.
7. You will be prompted to restart the computer. Click Yes.

Then try running the virus scanner again.

You can check to see if the file is being loaded by preforming the
following steps:
1. Go to Start, "Run..."
3. type "regedit" and hit OK
4. Go to the key below by selecting the respective folders:
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
5. Look for an entry in first column of the listing on the right,
"Microsoft Diagnostic". If it is present, so is the virus.

If it's still there, you can (probably) eliminate it by deleting this
string and deleting the file associated with it listed in the second
column, then rebooting your computer by pressing control-alt-delete
twice after closing all open files.


Hope this helps, and please post a clarification request if you need
help with any of the above.

---

Request for Answer Clarification by terryt-ga on 31 May 2002 12:10 PDT

Many thanks.
What a relief,
The second option was the one that worked but can I switch System
restore safely back on or is it still corrupted and so not usable.
tt.

---

Clarification of Answer by bookface-ga on 31 May 2002 12:35 PDT

It should be ok; as a security precaution you might want to delete the
offending file first, if you remember it's name. If not, you can look
for a file in the C:\Windows\System directory with a size of 163,840
bytes (you can check individual file sizes by right clicking and going
to Properties.)

I would recommend leaving System Restore off anyway, however, as
besides being a security risk as in this instance, it also tends to
cause a lot of problems with stability.

Good luck, and thanks for using Google! Answers.